T09 · Insecure Skill Coding Practices
Warning
- Location
- bin/cli.js:40
- Finding
- Feishu App Secret Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `bin/cli.js:40-45` **Additional Locations**: `bin/cli.js:80-85`, `138-143`, `178-183`, `205-210`, `247-252`, `289-294`, `316-321`, `356-361`, `404-409` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```javascript .option('--app-id <id>', '飞书应用ID（覆盖环境变量）') .option('--app-secret <secret>', '飞书应用密钥（覆盖环境变量）') .action(async (options) => { try { if (options.appId) process.env.FEISHU_APP_ID = options.appId; if (options.appSecret) process.env.FEISHU_APP_SECRET = options.appSecret; ``` Equivalent `--app-secret` handling is repeated across every major CLI command. ### Technical Analysis The CLI permits the Feishu App Secret to be supplied directly as a command-line argument. Command-line arguments are not an appropriate secret transport mechanism because they can be exposed through: - Shell history files. - Process listings and operating-system process inspection interfaces. - Terminal session logging. - Job schedulers, command auditing, and monitoring platforms. - Diagnostic reports that capture process command lines. Copying the secret from `options.appSecret` into `process.env.FEISHU_APP_SECRET` does not remove it from `process.argv`, the parent shell's history, or external process telemetry. The secret grants application-level authentication through Feishu's tenant access-token endpoint. Its effective authority is determined by the permissions granted to the associated Feishu application. ### Attack Path 1. A user invokes a command such as: ```bash node bin/cli.js get \ --document-id dcnxxxxxx \ --app-id cli_xxxxxx \ --app-secret real_secret_value ``` 2. The complete command is recorded in shell history or remains visible in process metadata while the command runs. 3. A local user, process-monitoring agent, log collector, or party with access to the user's shell history obtains the secret. 4 ...[truncated 834 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `--app-secret` option from all CLI commands. 2. Accept secrets only through a protected environment variable or an external secret manager. 3. If interactive entry is required, use a hidden prompt that disables terminal echo. 4. For automation, support reading the secret from a protected file descriptor or a file with restrictive permissions instead of from the command line. 5. Avoid copying secrets into additional mutable locations unless required. 6. Clear in-memory secret references when feasible after client initialization. 7. Update documentation to warn users never to place credentials in command-line arguments. 8. Rotate any App Secret that has previously been supplied through this option. 9. Apply least-privilege Feishu permissions so compromise of the application credential has a restricted impact. ]]>